The first control in the CIS list is not a firewall or a password rule. It is knowing what you have. Inventory and control of enterprise assets, including the cloud ones, including the ones nobody bought on purpose.
Every framework starts there because everything else stands on it. You cannot patch the server nobody recorded. You cannot put the unlisted laptop in the risk register. Unmanaged and unknown are the same thing to an attacker.
The failure mode I keep meeting is the inventory that lives in a spreadsheet someone updates quarterly. The fix is unglamorous: discovery that runs continuously, from the network and the cloud accounts themselves, not declarations collected by email. What connects tells you the truth. What people remember does not.
https://www.cisecurity.org/controls/inventory-and-control-of-enterprise-assets
#CyberSecurity #InfoSec #AssetManagement
